PHP2Shell checker: a free PHP2Shell check for your PHP site
Check PHP2Shell (CVE-2026-109618 and CVE-2026-109619) in under a minute. This free, passive check reads the PHP version your site already reports and compares it with the fixed releases. No signup, no email needed: you get the result right here.
Free PHP2Shell check
What this checks
PHP2Shell, a PHP RCE tracked as CVE-2026-109618 and CVE-2026-109619, is fixed in specific PHP releases Sites on an older release of a supported branch remain affected. End-of-life branches have no php.net fix, though some OS vendors and hosts backport one. See the official advisory.
- 01Exposed: your site reports a PHP version on a supported branch below the fixed release.
- 02Probably safe: your site reports a PHP version at or above the fixed release.
- 03End-of-life, can't confirm: your site reports a PHP branch that's end-of-life. php.net has no fix, but your OS or host may have backported one without changing the version number, so verify with your host and plan an update.
- 04Unknown: your site doesn't report its PHP version, so an outside check can't tell.
- 05A version number is what the server says about itself. It can't confirm or rule out a compromise.
Questions
How do I check if I have PHP2Shell?
Enter your domain in the PHP2Shell checker above. It reads the PHP version your site reports in its response headers, compares it with the fixed releases in the advisory, and shows the result here (add an email if you also want it, with the fix steps, in your inbox). If your site hides its version, run php -v on the server (or ask your host) and compare it with the fixed release for your branch.
What is PHP2Shell?
PHP2Shell is the name Sansec gave to two critical bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), disclosed on 21 October 2026. Together they can allow remote code execution without a login. Because the bugs are in PHP, updating WordPress, Magento or another app doesn't fix them: upgrading PHP does.
Am I affected?
Your site is affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619) if its server runs a PHP version below the fixed release for its branch. End-of-life branches get no fix from php.net, but your OS or host may have backported one without changing the version number, so the version alone can't tell. The checker compares the version your site reports with the official advisory. If your site doesn't show its version (common behind a CDN such as Cloudflare), run php -v on the server or ask your host.
How do I fix it?
Upgrade PHP to the fixed release for your branch or later, or move off an end-of-life branch. If PHP comes from your Linux distribution's packages, install the distribution's security update: distributions often patch without changing the version number. Managed hosting: ask your host which PHP version you're on and when they patch.
Is the checker free?
Yes. The PHP2Shell check is free, with no account, card or email needed: enter a domain and you get the result on this page. Add an email if you want the result and the fix steps sent to you. Up to 5 checks per hour from one network.
What does the checker do to my site?
One passive visit: it reads your robots.txt, loads your homepage once and checks whether /wp-json/ answers, then reads the version your server reports in its response headers. It never sends an exploit or payload, never logs in, never posts anything and never tries the vulnerability. It honours robots.txt and identifies itself as kubepath-checker.
Why is my result Unknown?
Most often your server simply doesn't show its PHP version publicly, which is good practice. Unknown isn't a sign of a problem; it means this outside check can't tell. A short server-side check can confirm it.
Same week, same kind of bug: Node2Shell (CVE-2026-111497), a remote code execution flaw in Node.js's Brotli decoder, was fixed on 21 October 2026 too. Running Node.js as well? Check your version with the free Node2Shell checker, or see all kubepath tools.